Unitree Releases Critical Firmware Update for Go2 Robot
The update resolves a high-severity vulnerability that could allow remote command execution on the mobile platforms.
Updated on Oct. 28, 2026 in Robotics
Live Poll
Do you trust the security of internet-connected devices in your home?
Security researchers discovered a high-severity vulnerability in the firmware of Unitree Go2 robots that allows for unauthorized remote command execution. Unitree has released a firmware update to version 1.1.11.5 to address the flaw.
Why it matters
This vulnerability highlights the security risks inherent in increasingly connected robotics platforms as they move into consumer environments. Ensuring robust input validation in firmware is critical to preventing attackers from gaining system-level control over mobile hardware.
The flaw, tracked as CVE-2026-115995, features a critical 9.6 CVSS score. It stems from improper input validation in the set_volume function within the chat_go firmware process, affecting all versions up to 1.1.11.4.
The players
Unitree
A developer of legged, high-mobility robotics platforms, including the Go2 consumer-grade quadruped.
The details
The vulnerability allows attackers to inject and execute arbitrary system commands by manipulating the set_volume input field of the chat_go firmware process. Because the application lacks necessary sanitization, it treats malicious input strings as executable commands, granting the attacker the system privileges assigned to that process. This allows for remote compromise of the robot's operating environment.
Timeline
October 24, 2026: The vulnerability details were published by TheHackerWire.
The Tech Race
The vulnerability is currently absent from the CISA known exploited vulnerabilities list, signaling that it has not yet reached a threshold of documented widespread abuse. This places the issue in the early-disclosure phase of the security lifecycle, before attackers have established common exploit patterns.
Owners of Unitree Go2 robots should immediately update their firmware to version 1.1.11.5 or later to mitigate the risk of remote command execution. This update ensures that the input fields in the chat_go process properly validate user data.
The takeaway
The rapid patch release from the manufacturer is a standard response to high-severity firmware bugs, though long-term security depends on consistent update cycles. Owners should monitor official manufacturer communications for future security bulletins related to the Go2 platform.
Further reading
For broader trends in secure hardware, visit our Robotics section.
Source note: This article includes information reported by The Jolt Journal.
Live Poll
Do you trust the security of internet-connected devices in your home?
